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REMARKS 

This Application has been carefully reviewed in light of the Office Action mailed 
September 7, 2005. Claims 1-22 were pending in the Application. In the Office Action, Claims 
1-22 were rejected. In order to expedite prosecution of this Application, Applicants amend 
Claims 1, 7, 14, 15 and 19. Thus, Claims 1-22 remain pending in the Application. Applicants 
respectfully request reconsideration and favorable action in this case. 

In the Office Action, the following actions were taken or matters were raised: 

SECTION 103 REJECTIONS 

Claims 1-22 were rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. Patent 
No. 6,279,113 issued to Vaidya (hereinafter "Vaidya") in view of U.S. Patent No. 6,578,147 
issued to Shanklin et al. (hereinafter "Shanklin"). Applicants respectfully traverse this rejection. 

Of the rejected claims, Claims 1, 7, 14 and 19 are independent. Applicants respectfully 
submit that neither Vaidya nor Shanklin, alone or in combination, discloses, teaches or suggests 
the limitations of independent Claims 1, 7, 14 and 19. For example, independent Claim 1, as 
amended, recites "reading a first packet received by the node," "comparing [a] first signature 
[of the first packet] with a signature file comprising a first machine-readable logic 
representative of a first packet signature," "reading a second packet generated by the node in 
response to reception of the first packet," "comparing [a] second signature [of the second 
packet] with the signature file" and " identifying the first packet as an intrusion if the first 
signature corresponds with the first machine readable logic and the second signature 
corresponds with the second machine readable logic" (emphasis added). 

In the Office Action, the Examiner admits that Vaidya does not explicitly disclose 
reading the response packet of the first packet, extracting the signature of the second packet 
and comparing the signature with a signature file (Office Action, page 3). Shanklin appears to 
disclose a router 12 that inspects packets incoming from the external network to determine which 
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should be forwarded into the local network 10, and that packets originating in the local network 
are inspected to determine whether they are to be forwarded to the external network (Shanklin, 
column 3, lines 30-34). However, neither Vaidya nor Shanklin, alone or in combination, 
discloses, teaches or suggests " identifying the fir st packet [received] as an intrusion" if the 
"signature [ of the first packet ] corresponds with the first machine readable logic and the 
second signature [of the second packet] corresponds with the second machine readable logic" 
as recited by independent Claim 1 (emphasis added). Accordingly, for at least this reason, 
independent Claim 1 is patentable over the cited references. 

Independent Claim 7, as amended, recites "reading a first packet," "comparing [a] first 
signature [of the first packet] with a first instruction set comprising a first set of machine 
readable logic representative of a first packet signature," "reading a second packet generated in 
response to reception of the first packet," "comparing [a] second signature [of the second packet] 
with a second instruction set comprising a second set of machine readable logic representative of 
a second packet signature" and "identifying the first, packet as an intrusion if the first signature 
corresponds with the first set of machine readable logic and the second signature corresponds 
with the second set of machine readable logic" (emphasis added), and independent Claim 14, as 
amended, recites a "network filter service provider operable to receive a first packet and . . . and 
compare [a] first signature [of the first packet] with a first instruction set comprising a first set of 
machine readable logic representative of a first packet signature," "receive a second packet 
generated in response to receipt of the first packet and . . . compare [a] second signature [of the 
second packet] with a second instruction set comprising a second set of machine readable logic 
representative of a second packet signature" and " identify the first packet as an intrusion if the 
first signature corresponds with the first set of machine readable logic and the second signature 
corresponds with the second set of machine readable logic" (emphasis added). Thus, at least for 
the reasons discussed above in connection with independent Claim 1, independent Claims 7 and 
14 are also patentable over the cited references. 
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Further, independent Claim 19, as amended, recites "reading a response packet by the 
node, the response packet generated in response to reception of a first packet by the node," 
"determining a signature of the response packet," "comparing the signature with a signature file 
comprising a machine-readable logic representative of a packet signature" and "identifying the 
first packet as an intrusion if the signature [of the response packet] corresponds with the 
machine-readable logic" (emphasis added). Applicants respectfully submit that neither Vaidya 
nor Shanklin, alone or in combination, discloses, teaches or suggests identifying a first packet 
received by a node as an intrusion based on a signature of a response packet to the first packet as 
generally recited by independent Claim 19. Thus, at least this reason, Applicants respectfully 
submit that independent Claim 19 is patentable over the cited references. 

Claims 2-6, 8-13, 15-18, 21 and 22 depend respectively from independent Claims 1, 7, 14 
and 19. For at least the reasons discussed above, independent Claims 1, 7, 14 and 19 are in 
condition for allowance. Therefore, Claims 2-6, 8-13, 15-18, 21 and 22 that depend respectively 
therefrom are also in condition for allowance. Accordingly, Applicants respectfully request that 
the rejection of Claims 1-22 be withdrawn. 
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CONCL USI ON 



Applicants have made an earnest attempt to place this case in condition for immediate 
allowance. For the foregoing reasons and for other reasons clearly apparent, Applicants 
respectfully request reconsideration and full allowance of all pending claims. 

An RCE filing fee of $790.00 is believed due. The Director of Patents and Trademarks is 
hereby authorized to charge Deposit Account No. 08-2025 of Hewlett-Packard Company the 
amount of $790.00 to satisfy the RCE filing fee. If, however, Applicants have miscalculated the 
fee due with this RCE, the Director is hereby authorized to charge any fees or credit any 
overpayment associated with this RCE to Deposit Account No. 08-2025 of Hewlett-Packard 



Date: December 2, 200 5 

Correspondence to: 

L.Joy Griebenow 

Hewlett-Packard Company 

Intellectual Property Administration 

P. O. Box 272400 

Fort Collins, CO 80527-2400 

Tel. 970-898-3884 



Company. 



Respectfully submitted, 




james L. Baudino 
Reg. No. 43,486 
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